For a large-scale and complicated physical system such as a nuclear plant or a chemical plant, state values (measured values, performance values) for the physical system and the like are measured using sensors (detection ends) such as thermometers. The measured state value is stored as performance information, for example, by being associated with the time when it was measured for each sensor used for measurement. From the performance information, time-series data (time-series information, time series record) about the performance information is made by extracting measurement values during a certain period.
When a physical system, i.e., a monitoring target, is monitored, for example, relevance between a plurality of measurement values included in the performance information is analyzed with, for example, an analysis method such as correlation analysis. The correlation analysis is also used as a method for detecting abnormality of a large-scale information system including a large number of servers and communication network equipment.
An operation management apparatus disclosed in the PTL 1 reads, as time-series data, measurement values during the period of time in which the physical system is operating normally from two different pieces of performance information (hereinafter referred to as “first performance information”, “second performance information”). The operation management apparatus generates a correlation model by deriving a mathematical relational expression between two pieces of read time-series data. For example, the operation management apparatus reads, as first time-series data, measurement values in the monitoring period of time in which the physical system is measured from the first performance information, and reads, as second time-series data, measurement values in the monitoring period of time from the second performance information.
The operation management apparatus estimates second time-series data by applying the generated correlation model to first time-series data. The operation management apparatus compares the read second time-series data with the estimated second time-series data, and determines whether the generated correlation model is also satisfied for the time-series data in the monitoring period of time based on the comparison result. In other word, the operation management apparatus determines whether or not the generated correlation model is also maintained with regard to the time-series data on the monitoring period of time.
The operation management apparatus disclosed in the PTL 2 measures measurement values on multiple performance indexes for the apparatuses serving as the monitoring targets, and determines whether or not the measured measurement values are abnormal. When the measurement values are determined to be abnormal, the operation management apparatus selects the performance indexes on the measurement values as abnormal items. The operation management apparatus excludes, from each abnormal item, abnormal items specified for each apparatus which is the monitoring target. As a result, the operation management apparatus can specify the factor of abnormality in a shorter period of time, when a plurality of servers detect abnormality.
The operation management apparatus disclosed in PTL 3 has a model generation unit, which derives the change of time-series data for a plurality of performance information measured by a plurality of managed apparatuses such as sensors, and calculates a correlation model representing the correlation between changes relating to the plurality of pieces of derived time-series data. The operation management apparatus further includes an analysis unit, which calculate time-series data about the performance information newly detected, and determines whether or not the calculated correlation model is satisfied or not, on the basis of the calculated time-series data. Therefore, the operation management apparatus can detect (determine) a failure based on whether or not the correlation model is satisfied.
The remote monitoring system disclosed in PTL 4 has a model construction unit, which a first correlation satisfied between a plurality of measurement values measured for a monitoring target within a period of time in which the monitoring target is normally operating, and a second correlation that is satisfied between some of the measurement values. The remote monitoring system further includes a detection unit which applies each of the first correlation and the second correlation to the measurement values measured within a monitoring period of time for the monitoring target, and detects as to whether the monitoring target malfunctions or not on the basis of the calculated result.